357b2b62220ebb1531d7e318e797367f6184baa6d58abc33499a1869d1a60334

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 08:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
composer.dat.exe
Size 13.7MB
Sample260809-ktjyyack5y
SHA256 357b2b62220ebb1531d7e318e797367f6184baa6d58abc33499a1869d1a60334
MD5 5ee5d746248c1690e0ba39a25fbf358f
SHA1 cba60a7063e5e4f3b37b1cbf3287d9e13757f002
SHA512 114a0da9df03f6a3f3433b1dcc1af2a74d28cd1ec2b9cbc521c16a070403a459227b7c2d6b0c142c7f9cafd027bd390edc889e6082635cffa914e0f42eaf689c
SSDEEP 393216:91GmQkmV2lCMyXAPhaRoyI0IXMCHWUjIcuI3/PGTAI:91GzkfrZaWgIXMb89H/O7
TLSH
T12DE6330431D115FEE6E3D1B9ACD24A90E0BEB4262779C9CB97A486516D333F0893DB63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3844	powershell.exe
976	powershell.exe
5740	powershell.exe
5140	powershell.exe
2404	powershell.exe
4660	powershell.exe
3032	powershell.exe
972	powershell.exe
5336	powershell.exe
5092	powershell.exe
4852	powershell.exe
5200	powershell.exe

Loads dropped DLL 15 IoCs

pid	Process
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe
3220	composer.dat.exe

Executes a command shell one-liner 1 TTPs 12 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2436	cmd.exe
4796	cmd.exe
5712	cmd.exe
4224	cmd.exe
2760	cmd.exe
1524	cmd.exe
2480	cmd.exe
3560	cmd.exe
3916	cmd.exe
2312	cmd.exe
3516	cmd.exe
2292	cmd.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3220	composer.dat.exe
3220	composer.dat.exe
972	powershell.exe
972	powershell.exe
5140	powershell.exe
5140	powershell.exe
5336	powershell.exe
5336	powershell.exe
5092	powershell.exe
5092	powershell.exe
2404	powershell.exe
2404	powershell.exe
4660	powershell.exe
4660	powershell.exe
4852	powershell.exe
4852	powershell.exe
5200	powershell.exe
5200	powershell.exe
3844	powershell.exe
3844	powershell.exe
976	powershell.exe
976	powershell.exe
3032	powershell.exe
3032	powershell.exe
5740	powershell.exe
5740	powershell.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3220	composer.dat.exe
Token: SeDebugPrivilege	972	powershell.exe
Token: SeDebugPrivilege	5140	powershell.exe
Token: SeDebugPrivilege	5336	powershell.exe
Token: SeDebugPrivilege	5092	powershell.exe
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	4660	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	5200	powershell.exe
Token: SeDebugPrivilege	3844	powershell.exe
Token: SeDebugPrivilege	976	powershell.exe
Token: SeDebugPrivilege	3032	powershell.exe
Token: SeDebugPrivilege	5740	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 3220	4820	composer.dat.exe	86
PID 3220 wrote to memory of 2436	3220	composer.dat.exe	88
PID 2436 wrote to memory of 972	2436	cmd.exe	90
PID 3220 wrote to memory of 4796	3220	composer.dat.exe	91
PID 4796 wrote to memory of 5140	4796	cmd.exe	93
PID 3220 wrote to memory of 5712	3220	composer.dat.exe	94
PID 5712 wrote to memory of 5336	5712	cmd.exe	97
PID 3220 wrote to memory of 4224	3220	composer.dat.exe	99
PID 4224 wrote to memory of 5092	4224	cmd.exe	101
PID 3220 wrote to memory of 2760	3220	composer.dat.exe	102
PID 2760 wrote to memory of 2404	2760	cmd.exe	104
PID 3220 wrote to memory of 1524	3220	composer.dat.exe	105
PID 1524 wrote to memory of 4660	1524	cmd.exe	107
PID 3220 wrote to memory of 2480	3220	composer.dat.exe	108
PID 2480 wrote to memory of 4852	2480	cmd.exe	110
PID 3220 wrote to memory of 3560	3220	composer.dat.exe	111
PID 3560 wrote to memory of 5200	3560	cmd.exe	113
PID 3220 wrote to memory of 3916	3220	composer.dat.exe	114
PID 3916 wrote to memory of 3844	3916	cmd.exe	116
PID 3220 wrote to memory of 2312	3220	composer.dat.exe	117
PID 2312 wrote to memory of 976	2312	cmd.exe	119
PID 3220 wrote to memory of 3516	3220	composer.dat.exe	120
PID 3516 wrote to memory of 3032	3516	cmd.exe	122
PID 3220 wrote to memory of 2292	3220	composer.dat.exe	123
PID 2292 wrote to memory of 5740	2292	cmd.exe	125

C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
"C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\composer.dat.exe
  "C:\Users\Admin\AppData\Local\Temp\composer.dat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2436
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cosojad'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4796
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\cosojad'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'D:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'D:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'E:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'E:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'F:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'F:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'G:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2480
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'G:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'X:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'X:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Y:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'Z:\'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3516
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...